Extracted

Extracted

• • Target

    73ab256ff82943dcf2044921c1f692bc4f620c1e2495a048382b6b273c09ee82

  • Size

    779KB

  • MD5

    8f0b39472d11a415aae8bda1ae76e69b

  • SHA1

    d14bd45a97b822ce6d8518d7cf128390de3cdf38

  • SHA256

    73ab256ff82943dcf2044921c1f692bc4f620c1e2495a048382b6b273c09ee82

  • SHA512

    800433ededb5a4d427686c87a8b1acfef7f1d0dd1fd9760c45ccb4eaf31db5fc9b4222f92a67e76dad5a1c59206a5ca6d955e07617f854421e74f4b50318c693

  • SSDEEP

    24576:wypmYuOWL6Pdsec2z57Utj12AEvWyMBx:3pmYuR6PdseBOtj12Lv4

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1